🎣 feat: comprehensive git hooks and CI pipeline setup

.devcontainer/Dockerfile

@@ -47,4 +47,4 @@ ENV PATH="/home/vscode/.local/bin:${PATH}"
 ENV PYTHONPATH="/workspaces/ai-command-auditor/scripts/python:${PYTHONPATH}"
 
 # Default command
-CMD ["bash"] 
+CMD ["bash"]

.devcontainer/devcontainer.json

@@ -3,15 +3,15 @@
     "dockerComposeFile": "docker-compose.yml",
     "service": "devcontainer",
     "workspaceFolder": "/workspaces/ai-command-auditor",
-    
+
     "customizations": {
         "vscode": {
             "extensions": [
                 "ms-python.python",
                 "ms-python.black-formatter",
                 "timonwong.shellcheck"
             ],
-            
+
             "settings": {
                 "python.defaultInterpreterPath": "/usr/local/bin/python",
                 "python.formatting.provider": "black",
@@ -20,8 +20,8 @@
             }
         }
     },
-    
+
     "postCreateCommand": "pip install --user -r requirements-dev.txt",
-    
+
     "remoteUser": "vscode"
-} 
+}

.devcontainer/docker-compose.yml

@@ -5,41 +5,41 @@ services:
     build:
       context: .
       dockerfile: Dockerfile
-    
+
     volumes:
       # Mount the workspace folder
       - ..:/workspaces/ai-command-auditor:cached
-      
+
     # Keep container running
     command: sleep infinity
-    
+
     # Environment variables
     environment:
       - PYTHONPATH=/workspaces/ai-command-auditor/scripts/python
-      
+
     # Working directory
     working_dir: /workspaces/ai-command-auditor
-    
+
     # Port forwarding
     ports:
       - "8000:8000"
       - "8080:8080"
       - "3000:3000"
       - "5000:5000"
       - "9000:9000"
-    
+
     # User configuration
     user: vscode
-    
+
     # Security options
     security_opt:
       - seccomp:unconfined
-    
+
     # Capabilities for debugging and system-level tools
     cap_add:
       - SYS_PTRACE
       - NET_ADMIN
-    
+
     # Resource limits (adjust as needed)
     deploy:
       resources:
@@ -52,4 +52,4 @@ volumes:
   devcontainer-bash-history:
     driver: local
   devcontainer-pip-cache:
-    driver: local 
+    driver: local

.github/workflows/ci.yml

@@ -0,0 +1,257 @@
+name: CI Pipeline
+
+on:
+  push:
+    branches: [ main, develop ]
+  pull_request:
+    branches: [ main, develop ]
+
+env:
+  PYTHON_VERSION: '3.11'
+  NODE_VERSION: '18'
+
+jobs:
+  lint-python:
+    name: Python Linting
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: ${{ env.PYTHON_VERSION }}
+
+    - name: Cache pip dependencies
+      uses: actions/cache@v3
+      with:
+        path: ~/.cache/pip
+        key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements*.txt') }}
+        restore-keys: |
+          ${{ runner.os }}-pip-
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install -r requirements.txt
+        pip install -r requirements-dev.txt
+
+    - name: Run Black (Code Formatting)
+      run: |
+        black --check --diff scripts/python/
+
+    - name: Run isort (Import Sorting)
+      run: |
+        isort --check-only --diff --profile=black scripts/python/
+
+    - name: Run Pylint (Code Quality)
+      run: |
+        pylint scripts/python/ --exit-zero --reports=no --output-format=colorized
+
+    - name: Run MyPy (Type Checking)
+      continue-on-error: true
+      run: |
+        mypy --explicit-package-bases scripts/python/
+
+  lint-bash:
+    name: Bash Linting
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Install ShellCheck
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y shellcheck
+
+    - name: Run ShellCheck
+      run: |
+        find scripts/bash -name "*.sh" -type f | xargs shellcheck
+
+  test-python:
+    name: Python Tests
+    runs-on: ubuntu-latest
+    needs: lint-python
+
+    strategy:
+      matrix:
+        python-version: ['3.9', '3.10', '3.11']
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v4
+      with:
+        python-version: ${{ matrix.python-version }}
+
+    - name: Cache pip dependencies
+      uses: actions/cache@v3
+      with:
+        path: ~/.cache/pip
+        key: ${{ runner.os }}-pip-${{ matrix.python-version }}-${{ hashFiles('**/requirements*.txt') }}
+        restore-keys: |
+          ${{ runner.os }}-pip-${{ matrix.python-version }}-
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install -r requirements.txt
+        pip install -r requirements-dev.txt
+
+    - name: Create necessary directories
+      run: |
+        mkdir -p logs
+        mkdir -p scripts/python/tests
+
+    - name: Run pytest
+      run: |
+        python -m pytest scripts/python/tests/ -v --cov=scripts/python --cov-report=xml --cov-report=term-missing
+
+    - name: Upload coverage to Codecov
+      uses: codecov/codecov-action@v3
+      with:
+        file: ./coverage.xml
+        flags: unittests
+        name: codecov-umbrella
+
+  test-bash:
+    name: Bash Tests
+    runs-on: ubuntu-latest
+    needs: lint-bash
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Install BATS
+      run: |
+        git clone https://github.com/bats-core/bats-core.git
+        cd bats-core
+        sudo ./install.sh /usr/local
+
+    - name: Create test directory if it doesn't exist
+      run: |
+        mkdir -p scripts/bash/tests
+
+    - name: Run BATS tests (if any exist)
+      run: |
+        if find scripts/bash/tests -name "*.bats" -type f | grep -q .; then
+          bats scripts/bash/tests/
+        else
+          echo "No BATS tests found, skipping..."
+        fi
+
+  integration-tests:
+    name: Integration Tests
+    runs-on: ubuntu-latest
+    needs: [test-python, test-bash]
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: ${{ env.PYTHON_VERSION }}
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install -r requirements.txt
+        pip install -r requirements-dev.txt
+
+    - name: Create necessary directories
+      run: |
+        mkdir -p logs
+
+    - name: Test command checker with safe command
+      run: |
+        python scripts/python/core/check_command.py "ls -la" | grep -q "PASS"
+
+    - name: Test command checker with dangerous command
+      run: |
+        python scripts/python/core/check_command.py "rm -rf /" | grep -q "ERROR"
+
+    - name: Test configuration loading
+      run: |
+        python -c "
+        import sys
+        sys.path.insert(0, '.')
+        from scripts.python.core.config import get_config
+        config = get_config()
+        assert config.get_rules_file() is not None
+        print('✅ Configuration loading test passed')
+        "
+
+    - name: Test security validation
+      run: |
+        python -c "
+        import sys
+        sys.path.insert(0, '.')
+        from scripts.python.core.security import validate_command
+        is_safe, error = validate_command('ls -la')
+        assert is_safe == True
+        is_safe, error = validate_command('rm -rf /')
+        assert is_safe == False
+        print('✅ Security validation test passed')
+        "
+
+  security-scan:
+    name: Security Scan
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: ${{ env.PYTHON_VERSION }}
+
+    - name: Install security tools
+      run: |
+        python -m pip install --upgrade pip
+        pip install bandit safety
+
+    - name: Run Bandit (Security Linting)
+      run: |
+        bandit -r scripts/python/ -f json -o bandit-report.json || true
+        bandit -r scripts/python/ --exit-zero
+
+    - name: Run Safety (Dependency Vulnerability Check)
+      run: |
+        safety check --json --output safety-report.json || true
+        safety check
+
+    - name: Upload Security Report
+      if: always()
+      uses: actions/upload-artifact@v4
+      with:
+        name: security-report
+        path: security-report.txt
+        retention-days: 30
+
+  build-success:
+    name: Build Success
+    runs-on: ubuntu-latest
+    needs: [lint-python, lint-bash, test-python, test-bash, integration-tests, security-scan]
+    if: success()
+
+    steps:
+    - name: Success notification
+      run: |
+        echo "🎉 All CI checks passed successfully!"
+        echo "✅ Python linting passed"
+        echo "✅ Bash linting passed"
+        echo "✅ Python tests passed"
+        echo "✅ Bash tests passed"
+        echo "✅ Integration tests passed"
+        echo "✅ Security scan completed"

.gitignore

@@ -318,4 +318,4 @@ id_ed25519*
 # Performance and profiling files
 *.prof
 *.hprof
-*.pprof 
+*.pprof